You want to know if employee who is about to leave is dropping lots of data to dropbox…

Service account - non expiring account

Domain admin activity

Smart detection of deception

Account leak in massive data breachNetwork ingress from multiple locationElevated admin privilegesAuthentication from disable accountsRe-enabling disabled accountRemote access with service accountsTraffic from TOR nodes or known proxy serversAddition of an unusual number of mobile device

Involved in mega breach

A lot of people use the same password across different services.

Alert if same user access network from different location in short period of time.